Ransom.Sodinokibi (19.06.14)

petr0vic

火绒 5
s.exe, Detection: HVM:VirTool/Obfuscator.gen!A

18927058963

微点扫描无毒，运行主防杀了

dsb2466

Kill one，Block one

Nocria

G DATA.


s.exe

1. During Open the file "C:\Users\promi\AppData\Local\Temp\BNZ.5d036ab4b68f5\s.exe" the "Gen:Trojan.Heur.JP.pmGfa8tjU@aG (Engine A)" virus was detected. Access denied. (Engine A: AVA 25.22369, Engine B: GD 25.15317)

复制代码

s1.exe

1. Harmful access by an encryption Trojan to your file system has been detected (Malware: Cerber).
   
2. 
   
3. The following processes were therefore terminated by G DATA for security reasons:
   
4.         ----------------------------------------------------------------
   
5.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 2836)
   
6.         C:\Windows\System32\taskhost.exe (PID 1828)
   
7.         C:\Windows\System32\sppsvc.exe (PID 5008)
   
8.         C:\Windows\System32\svchost.exe (PID 2232)
   
9.         C:\Windows\System32\rundll32.exe (PID 3696)
   
10.         C:\Windows\System32\InputMethod\CHS\ChsIME.exe (PID 6244)
    
11.         C:\Program Files\Bandizip\Bandizip.exe (PID 6864)
    
12.         C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe (PID 4512)
    
13.         C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe (PID 1860)
    
14.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 1092)
    
15.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 4708)
    
16.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 5748)
    
17.         C:\Users\promi\AppData\Roaming\Maxthon5\Public\MxUp\MxUp.exe (PID 5864)
    
18.         C:\Windows\System32\taskhostex.exe (PID 2372)
    
19.         C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe (PID 6748)
    
20.         C:\Program Files\Bandizip\Updater.exe (PID 6912)
    
21.         C:\Windows\explorer.exe (PID 1268)
    
22.         C:\Windows\System32\svchost.exe (PID 948)
    
23.         C:\Windows\System32\svchost.exe (PID 1164)
    
24.         C:\Users\promi\AppData\Local\Temp\BNZ.5d036af7c70e0\s1.exe (PID 6472)
    
25.         ----------------------------------------------------------------
    
26. 
    
27. The following programs responsible were moved to Quarantine by G DATA:
    
28.         ----------------------------------------------------------------
    
29.         C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\DiagPackage.dll
    
30.         ----------------------------------------------------------------
    
31. 
    
32. Detected suspicious activities:
    
33.         ----------------------------------------------------------------
    
34.         Deleted: Volume Shadow Copies
    
35.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\CL_Utility.ps1
    
36.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\DiagPackage.diagpkg
    
37.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\DiagPackage.dll
    
38.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\RS_AdminDiagnosticHistory.ps1
    
39.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\RS_MachineWERQueue.ps1
    
40.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\RS_SyncSystemTime.ps1
    
41.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\RS_UserDiagnosticHistory.ps1
    
42.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\RS_UserWERQueue.ps1
    
43.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\TS_DiagnosticHistory.ps1
    
44.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\TS_InaccurateSystemTime.ps1
    
45.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\TS_WERQueue.ps1
    
46.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\zh-CN\CL_LocalizationData.psd1
    
47.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\zh-CN\DiagPackage.dll.mui
    
48.         Created: C:\Windows\Temp\SDIAG_59f17b38-7e87-4b00-8743-66be5be9185d\result\results.xsl
    
49.         ----------------------------------------------------------------
    
50. 
    

复制代码

a233

Avast

a233

火绒

www-tekeze

智量Heur清空，晚上抽空测双击。。    补充：关闭监控双击，主防杀！

liangxy

Jirehlov1234 发表于 2019-6-14 16:55
BD

s.exe - Gen:Trojan.Heur.JP.pmGfa8tjU@aG

我这里，bd free miss s1.exe，请问你是bd什么版本？

岂曰无衣

360

Jirehlov1234

liangxy 发表于 2019-6-14 19:34
我这里，bd free miss s1.exe，请问你是bd什么版本？

BDTS

你可能需要双击来触发这个云杀